无法验证使用es256签名的Keycloak生成的JWT

Question

I'm trying to use Keycloak as an OpenID provider. Because of compliance reasons I cannot use RSA and must use ECDSA keys to sign the tokens. I'm using ES256 to sign the tokens generated by Keycloak.

I've created a simple asp.net core server that requires authentication for all controllers. This is an example of the startup.cs file:

public class Startup
{
   public Startup(IConfiguration configuration)
   {
      Configuration = configuration;
   }

   public IConfiguration Configuration { get; }

   // This method gets called by the runtime. Use this method to add services to the container.
   public void ConfigureServices(IServiceCollection services)
   {
      IdentityModelEventSource.ShowPII = true;
      services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);

      services.AddAuthentication(options => {
         options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
         options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
      })
      .AddJwtBearer(options => {
         options.RequireHttpsMetadata = false;
         options.Authority = "[keycloak address]";
         options.Audience = "hello";
      });

      services.AddSingleton<IAuthorizationHandler, DebugAuthorizationHandler>();
   }

   // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
   public void Configure(IApplicationBuilder app, IHostingEnvironment env)
   {
      if (env.IsDevelopment())
      {
         app.UseDeveloperExceptionPage();
      }

      app.UseAuthentication();
      app.UseMvc();
   }
}

I also have a client that performs authentication with Keycloak, receives the access token, and then calls the asp.net core server with the access token.

The call fails in the server with the following error code:

info: Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler[1] Failed to validate the token.

Microsoft.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException: IDX10501: Signature validation failed.

The same code succeeds when using RS256 to sign the tokens.

Has anyone experienced a similar issue?

Answer 1

After digging further into the issue, it looks like Keycloak does not return the JWT signature in a standard way.

They currently have an open issue about it.

For more info look here